← Back to feed

Google DeepMind has published a paper formalising what security researchers have demonstrated in scattered experiments over the past 18 months: the web itself is an attack surface for AI agents. The paper provides the first systematic taxonomy of adversarial techniques, along with success rates against production-grade agent architectures.

The Six Attack Categories

The taxonomy organises attacks into six types based on delivery mechanism:

1. Hidden text injection — instructions buried in HTML comments or rendered as white-on-white text, invisible to human users but parsed by agent scrapers
2. Pixel steganography — adversarial content encoded in image pixels at a level imperceptible to the human eye
3. Metadata override — commands embedded in PDFs, document metadata, or presentation speaker notes that agents parse as content
4. Latent memory poisoning — malicious instructions placed in a RAG corpus or persistent memory store to activate in later sessions
5. Goal hijacking — mid-session redirection that substitutes the agent’s assigned objective with an attacker’s goal
6. Cross-agent cascade — propagating a compromised instruction through multi-agent pipelines, where a hijacked sub-agent infects downstream agents

The Numbers

Across five different agent architectures tested in the paper’s cited benchmarks, success rates were high across all categories. Hidden prompt injections embedded in web content partially or fully hijacked agents in up to 86% of scenarios. Sub-agent hijacking via cross-agent cascades succeeded 58-90% of the time. Data exfiltration attacks cleared 80% success across all five architectures tested.

The most alarming result is the latent memory poisoning threshold. At less than 0.1% data contamination of a RAG corpus — meaning one adversarial document per thousand legitimate ones — attack success rates stayed above 80%. Unlike real-time injection attacks, latent poisoning does not need to win in the moment; it sits quietly in a memory store until an agent retrieves a relevant chunk and the instruction activates.

Why the Threat Model Matters

The paper’s framing is an important reorientation of how agent safety is typically discussed. Most safety discourse focuses on what happens inside model weights — jailbreaks, alignment failures, training distribution shifts. The DeepMind taxonomy describes a different class of problem: the environment agents operate in is adversarial by design, not just incidentally hostile.

A web page does not need to look malicious to be dangerous to an agent. Agents parse what humans never see: raw HTML, metadata fields, CSS-hidden text, formatting syntax, and binary media content. A site that passes a human review can still be a functioning trap for any agent that reads it.

The memory poisoning result makes this worse in an important way. Once agents acquire persistent memory — which is increasingly standard in production deployments — a single compromised document can affect all future sessions that retrieve related material. The attack does not need to be present when the damage occurs.

Deployment Implications

For anyone operating production AI agents that browse the web, read documents, or use persistent memory, the paper implies several architectural changes that are not yet standard practice: content provenance tracking at the retrieval layer, sandboxed memory that distinguishes high-trust from low-trust sources, and monitoring for instruction-like patterns in retrieved context before they enter the agent’s action chain.

The hardest class to defend against remains cross-agent cascades in multi-agent architectures, where the attack surface scales with the number of agents and connections rather than with any single model’s defences.